Number of users requested from the LDAP server

Sometimes, when you access the LDAP Manager module or the LDAP Resources page, or you perform a search in the LDAP Resources page, the following error message is displayed: “The number of users requested from the LDAP server exceeds the size limit”. This happens because the LDAP server has a size limit configured for the search results. In this case, only a certain number of entries can be returned. If the number of users requested from the LDAP server exceeds the number of maximum results (size limit) defined for the LDAP server, the application is not able to get all of them.

To help you reduce the number of LDAP entries returned so that you do not reach the defined limit, and to minimize the calls to the LDAP Server, the following LDAP server settings are added to the configureLDAPServer JMX method.

• nrOfUsersRetrievedAtOnce: Allows you to specify the number of users that may be retrieved at once from the LDAP server. The default value is 0.

  • 0: the LDAP Server does not restrict the number of users retrieved at search (unlimited search)

  • Greater than 0 (between 1 and 400): the LDAP Server restricts the number of users retrieved at search (limited search)

• distinguishedNameAttr: Allows you to specify the Distinguished Name Attribute as it is defined on the current LDAP Server. By default, this field is empty.

  • when this is empty (default), the users are retrieved one by one

    Note The search process takes a while when the users are retrieved one by one.

  • when the Distinguished Name Attribute as it is defined on the current LDAP Server is provided, multiple users are retrieved at once.

  Caution Make sure you enter the exact value of the distinguished name attribute. If you do not the know the LDAP Server’s distinguished name attribute, leave this setting empty.

  The distinguishedNameAttr setting is relevant only in combination with the nrOfUsersRetrievedAtOnce setting.

How to configure the number of users that may be retrieved at once from the LDAP server

To configure the number of users that may be retrieved at once from the LDAP server, follow these steps:

1. On the UCMDB server machine, launch your Web browser and enter the following address: https://localhost:8443/jmx-console.

   You may need to log in with a user name and password.

2. Locate the configureLDAPServer method in the UCMDB:service=LDAP Services category.

3. Provide values for the following fields:

   nrOfUsersRetrievedAtOnce: A number smaller than the size limit configured for the LDAP server

   distinguishedNameAttr: The Distinguished Name Attribute as it is defined on the current LDAP Server.

4. Click Invoke.

Example: How to properly configure the number of users that may be retrieved at once from the LDAP server

This is just an example to help you understand how to use the newly added settings (nrOfUsersRetrievedAtOnce, and distinguishedNameAttr).

In this example, the following values will be used:

• Group 1 – with 10 users
• Group 2 – with 15 users
• Group 3 – with 48 users
• LDAP server size limit: 20 (this means that the LDAP server has limited the search results to 20 users)
• Distinguished Name Attribute: LDAPattr

The following scenarios show what happens when different values are used for the nrOfUsersRetrievedAtOnce and distinguishedNameAttr settings.

Scenario 1

Input

• nrOfUsersRetrievedAtOnce: 0

• distinguishedNameAttr: (empty)

Output

When performing a search in the LDAP Resources page, the following error message is displayed: “The number of users requested from the LDAP server exceeds the size limit”.

This error happens because the LDAP server is limited to 20 users, and the number of users requested from the LDAP server is 73 (Group 1 + Group 2 + Group 3).

Scenario 2.1

Input

• nrOfUsersRetrievedAtOnce: 40

• distinguishedNameAttr: (empty)

Output

When performing a search in the LDAP Resources page, all the three groups (73 users) are retrieved. Since the distinguishedNameAttr setting has no value added, the users are retrieved one by one, and the LDAP server size limit is not reached.

The search process takes a while when the users are retrieved one by one.

Scenario 2.2

Input

• nrOfUsersRetrievedAtOnce: 40

• distinguishedNameAttr: LDAPattr

Output

In this scenario, the search functionality works for Group 1 and Group 2 (since the number of users is smaller than the LDAP server size limit), and it fails for Group 3 with the following error message: "The number of users requested from the LDAP server exceeds the size limit." The error appears because the chunk we want to retrieve is of 40 users, and the LDAP server size limit is 20.

Scenario 3.1

Input

• nrOfUsersRetrievedAtOnce: 19

• distinguishedNameAttr: (empty)

Output

When performing a search in the LDAP Resources page, all the three groups (73 users) are retrieved. Since the distinguishedNameAttr setting has no value added, the users are retrieved one by one, and the LDAP server size limit is not reached. The search process takes a while when the users are retrieved one by one.

Scenario 3.2

Input

• nrOfUsersRetrievedAtOnce: 19

• distinguishedNameAttr: LDAPattr

Output

When performing a search in the LDAP Resources page, all the three groups (73 users) are retrieved. This is because the users are retrieved in chunks of 19 users at once. The search process takes less time than it does in the scenario 3.1.

Scenario 4

Input

• nrOfUsersRetrievedAtOnce: 0

• distinguishedNameAttr: LDAPattr

Output

When performing the search in the LDAP Resources page, the following error message is displayed: “The number of users requested from the LDAP server exceeds the size limit”.

This error happens because the LDAP server is limited to 20 users, and the number of users requested from the LDAP server is 73.